CASL is not a misspelling of a pretty tower with a moat. CASL stands for Canadian Anti Spam Legislation and, ready or not, it takes full effect July 1, 2017.

CASL was announced way back in 2014 to give companies three years to get their processes compliant. On July 1, 2017, the regulation gets its teeth when certain provisions change around mailing people with Implied consent. Another big change–civil litigation becomes a real possibility as private citizens can bring suit.

Important June 8, 2017 Update: Canada has announced that it is suspending the Private Right of Action clause that was to take affect July 1, 2017. Everything else stays in place but this means that individuals can not file lawsuits as part of that deadline. Read more.

I’ve seen about every trick in the book for how companies dive into gray areas of permission marketing. When July 1st rolls around, your company does not want to play in that sandbox anymore when it comes to Canada.

If you have been putting off CASL compliance, this is your last chance. What does the CASL deadline mean to you? What can you do to get compliant? Read on for some tips to reduce your CASL exposure.

Part 1 of a 2-part Post.

In part 1, I’ll cover the reader’s digest edition of CASL and focus on why the July 1, 2017 is so important. Part 2 dives into the actionable steps you can take to reduce your compliance exposure.

CASL Compliance Summary: It’s Opt-in

There are plenty or articles that dive into CASL details that I’ve listed is the resources section so I’ll keep this section high level (Note that Express vs Implied Consent is broken out below.).

Compared to the CAN-SPAM Act in the United States which is mostly an opt-out regulation, CASL is an opt-in approach. There are slew of details to keep your legal team happy but it breaks down to this simple sentence.

Canadian recipients need to explicitly say they want to receive your emails and you have to prove it if asked.

I’ll write that again because no matter how confused you get, the 47-page act (pdf) always comes back to the same principle. Recipients need to explicitly say they want to receive your emails and you have to prove it if asked.

Yes, there are some Implied exceptions but if you can’t prove that someone wanted to receive your email, your organization is open to a lawsuit. The “oh, we think the person came in via a trade show list in April 2012” or “we’re not sure, we’re sorry” won’t work.

Resources

Official Canadian Radio-television and Telecommunications Commission (CRTC)

FightSpam.gc.ca (CRTC special site)

Full Copy of Law (CRTC)

Canada’s Anti-Spam Law (CASL) FAQ (Deloitte)

Deliverability Update: CASL Law Effective July 1, 2014 (Bronto)

Preparing for CASL’s private right of action (Osler)

Why the CASL July 1, 2017 Date is Important

When CASL was announced in 2014, companies had a three-year window to send people commercial electronic messages (CEMs) with implied consent. That time is over and here are the two main changes taking effect on July 1, 2017.

1. Implied Consent Now Expires. The bar is now raised where Implied consent now expires (24 months in most cases) and companies should keep track of that Implied date for record keeping.  What this means to you….
   • If your organization is mailing old Implied Canadian recipients that attended a trade show in 2013, you have until July 1, 2017 to make those Implied become Express. Otherwise, stop mailing them.
   • If your organization is mailing people where Country is unknown, it’s time for a little data cleansing and enrichment so you don’t mistakenly mail older Canadian records.
   • If your organization has bought lists that contain Canadian records, stop mailing them–that’s definitely over the line (and not a good practice anyway).
2. Individuals can File a Lawsuit (AKA. Private Right of Action). This is the really big change which differs from many other regulations. Up to July 1, 2017, only the Canadian governmental agencies could bring action. As of July 1, 2017, individuals can file suits against organizations and their officers, directors and agents. According to Lead Magnet, over 545,000 CASL complaints were lodged between July 2014 and May 2016 with very few fines. Even if just 1% of these people decide to file suits after the deadline, we’re talking some big numbers. What this means to you…
   • An increase in lawsuits since individuals can now file suit.

CASL Express vs Implied Consent

CASL spells out what is Express and what is Implied. Focusing on Canadian recipients, here’s a quick breakout. More details can be found on the CRTC site:

CASL Legal Implications

Legal suits are coming. Working in other industries, I’ve seen the effects of HIPAA, PCI and other privacy regulations. Those penalties happen but the penalties are mostly for the big guys.

CASL penalties are different. Come July 1, 2017, private citizens can file suit for infractions. The way the law is written, now every Tom, Dick and Harry can start to bring legal action.

54% of Canadians Would Sue for CASL Violations. itracMARKETER Poll

• Fine amounts: As high as $1 million for individuals and $10 million for businesses.
• Timeframe: Civil cases can be brought before the courts beginning July 2017.
• Who handles penalties:  Three agencies combine on enforcement. Canadian Radio-television and Telecommunications Commission (CRTC), the Competition Bureau (CB) and the Office of the Privacy Commissioner of Canada (OPC).

Beginning on July 1st 2017, the law will also allow individuals and organizations who are affected by an act or omission that is in contravention of the law to bring a private right of action in court against individuals and organizations whom they allege have violated the law. Once into force, the private right of action will allow an applicant to seek actual and statutory damages. Statutory damages may not be pursued if the person or organization against whom the contravention is alleged has entered into an undertaking or has been served with a Notice of Violation. CRTC

Some Existing CASL Penalties

For the thousands of complaints, the number of penalties is on the low side. However, unless there are some wording changes to the regulations, we expect to see this number increase as of July 1, 2017 once individuals can begin to file suit.

• Compu-Finder (March 2015). $1.1 Million Fine. This is the biggest fine to date. Compu-Finder sent commercial emails without consent, as well as messages in which the unsubscribe mechanisms did not function properly.
• Rogers Media Inc (November 2015). $200,000 Fine. From 3 July 2014 to 15 July 2015, Rogers Media Inc. sent certain commercial electronic messages (CEMs) to email addresses that either contained an unsubscribe mechanism that did not enable the person to indicate their wish to no longer receive messages or that was not able to be “readily performed”.
• Porter Airlines Inc (June 2015). $150,00 Fine. From 1 July 2014 to 23 February 2015, inclusively, Porter Airlines Inc. sent certain commercial electronic messages to email addresses for which it did not have proof of consent for each electronic address.
• Kellogg Canada (September 2016). $60,000 Fine. Kellogg and/or its third party service providers sent commercial electronic messages (“CEM”) to recipients without the consent of those recipients.

CASL Compliance – What Do You Do?

If you have been putting off CASL compliance, this is your last chance. Don’t risk a lawsuit.

We cover the 7 steps to reduce CASL compliance in the next post, but in the meantime, here is a checklist to get you started.

The Obvious Stuff

• Always include unsubscribe information/links in your CEMs (and make sure the mechanism works).
• Include your business information in all CEMs (business name, postal address, telephone number, email address).
• Read up on on compliance details today (or give us a call to help).

The Harder Stuff

• Establish an ongoing process for CASL compliance (Double Opt-in? Checkbox on all Forms? etc).
• Ensure your systems are set up to keep records to prove compliance if asked. For example, capture the date someone becomes Express or Implied.
• Figure out what you are going to do with existing data. You have until July 1, 2017 to determine who should get mailed and who shouldn’t under CASL. For example, if you have a Canadian lead from 2011 that has no activity, you probably want to suppress it from mailing (or delete it).
• Enforce policies and train your team to mail to only Canada Express or Implied (within date requirements) recipients.
• Moving forward, collect country values or you risk mailing to people in Canada when you shouldn’t. Most companies have a more lenient US mailing policy. If your company falls into this category, you’ll want to differentiate lists for mailings sent to Canada and ones sent to the US.

BONUS! Identify Canadian Records at No Cost

Only collecting email address? Don’t know which records are from Canada that need to comply with CASL?  We’re partnering with data provider Oceanos on a CASL-appending program that leverages social validation to identify Canadian records at no cost.* Learn more in the webinar or contact us now for more details.

* As with any data service. country match rates will vary depending on your audience and data. Since data accuracy  is not 100%, we recommend leveraging multiple data points to determine if a record is from Canada.  RevEngine Marketing and Oceanos are not responsible for inaccurate matches for compliance with CASL.

If you need help, please send me an email at jcoveney@revenginemarketing.com or sign up for our no-cost CASL Readiness Assessment.

Disclaimer: This post is designed to help you better understand the compliance requirements CASL. We are not lawyers and this should not be considered legal advice. As always, please have your attorneys review your own mailing policy.

The post What the July 1, 2017 CASL Deadline Means to You – Part 1 appeared first on RevEngine Marketing.